Tarun Wagjiani
@Tarun24000Completionist
0 followers3 downloads40 copies1 like393 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
This rule monitors Office 365 file download activity, identifying users whose download volume significantly deviates from their historical baseline. It specifically looks for an unusually high number of unique files downloaded in a one-hour window, while excluding known service accounts and synchronization agents like OneDrive sync client.
This alert detects a two stage behaviour associated with ClickFix style social engineering attacks, where a victim is tricked into manually executing a malicious command via the Windows Run dialog (WIN + R).
The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page.
The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download.
Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.
The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page.
The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download.
Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.